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company's business continuity, both from internal and external sources such as 
regulations, competition, markets, mergers and acquisitions, resources, and others 
in order to provide early warning for companies in taking mitigation steps for all 
these threats and risks. This research was done as a case study to gain an in-depth 
understanding of Internal Audit, Risk Management, and Early Warning Systems. 
The results of the research show that "Carrefour Indonesia" faces risks triggered 
by strategies that will be implemented in the future, and the application of the Risk 
Management Program at "Carrefour Indonesia" has not optimally provided early 
warning for the company, so improvements are needed in the system, resources 
and structure. Company so that the Early Warning System can be integrated with 
Risk Management. 
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Warning System 


INTRODUCTION 

Internal Audit is vital, especially in ensuring risk management runs to help achieve 
organizational goals. Internal Audit practices related to risk management include conducting audits 
of the external and internal environment and identifying current or potential risks and risks. Will be 
faced, and responses to these risks or potential risks will be determined. 

Risk management is a factor that has a significant influence on success or vice versa failure. 
Opportunity exploitation and risk management must run simultaneously to maximize existing 
opportunities and minimize risks to obtain adequate guarantees in achieving goals. 

Risk management carried out when dealing directly with the risk will be handled very 
differently compared to risk management that has been identified earlier before the risk occurs, 
mainly from readiness in responding to the risk, and this can only be achieved if there is a 
mechanism or system that can generate early warning. 

"Carrefour Indonesia" is the market leader in retail market share, especially for large-scale 
modern markets in Indonesia, when "Carrefour Indonesia" acquired Alfa Retailindo, Tbk. (2008) 
indicated that "Carrefour Indonesia" carried out monopolistic practices which then dragged it into 
the realm of law (2008-2010), thus threatening the company's existence so that it could continue to 
operate, in addition to the complexity and high tension of business competition as well as pressure 
as a market leader; making the threats faced by "Carrefour Indonesia" also increasingly complex, not 
only limited to competitors' threats, after the acquisition of Alfa Retailindo, Tbk. Business 
competition is getting more intense, marked by the closure of several outlets owned by "Carrefour 
Indonesia," which are no longer productive in supporting the company's business activities. 

The existing legal and competition problems ultimately also pushed "Carrefour Indonesia" to 
take a strategic step: the emergence of an alliance between "Carrefour Indonesia" and CT 
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Corporation. "Carrefour Indonesia" officially announced the release of 40% of its shares to CT 
Corporation (2010), which is expected to solve the company's various problems. In Risk 
Management, this step can be referred to as sharing risk, a response in dealing with existing risks by 
sharing/transferring some of the risks to other parties and finally relinquishing 100% of its 
ownership to CT Corporation. When viewed from 2 (two) parties, Carrefour S. A, this step in Risk 
Management is called avoid risk; from the CT Corporation side, this step in Risk Management is 
called accept risk. 

In 2010, Carrefour Indonesia assigned the Audit and Internal Control Department to develop 
a comprehensive Risk Management Program. What is hoped is the answer to guiding and providing 
a clearer picture for "Carrefour Indonesia" in facing threats and risks, which can then become the 
foundation for determining appropriate strategies and policies for the company. 

Researchers are concerned about the Risk Management Program carried out by "Carrefour 
Indonesia" implemented after the acquisition of PT. Alfa Retailindo, Tbk. At the same time, they face 
various risks that impact this acquisition step. Carrefour Indonesia's risk handling through the Risk 
Management Program is reactive handling of risks when they occur. Of course, this will be very 
different if the Risk Management Program is carried out at the time of change (acquisition) or before 
the change (acquisition) occurs. 

Based on the existing conditions, researchers are trying to conduct research in order to build a 
mechanism or system that can provide early warning to "Carrefour Indonesia" so that risk 
management can be responsive to changes that can bring risks, not reactive to current risks, and of 
course to create effectiveness and efficiency in business activities while creating added value and 
excellence. 

"Carrefour Indonesia" faces various risks; Risk management is necessary to ensure business 
continuity. The risks faced by "Carrefour Indonesia" currently come from external and internal 
companies, including the following: 


e External; a.) Regulation, b.) Competition, c.) Consumer changes, d.) Consumer demand 
e Internal; a.) Post-acquisition integration, b.) Loss of Intellectual property 

The Risk Management Program is a program (process) that aims to prepare users to identify, 
analyze, assess and evaluate threatening risks so that the results of this process can later be used in 
determining the appropriate attitudes and actions to take in dealing with these risks. 

This article will more specifically link the main tasks and functions of internal Audit with the 
Early Warning System in the Risk Management Program so that a deep understanding is gained that 
internal Audit plays a very vital role in the Early Warning System, which is an inherent part of the 
Risk Management Program. 

Considering the critical role of internal Audit in the Risk Management Program for "Carrefour 
Indonesia" in facing various threats/risks, this research aims to answer several questions, which are 
expected to be a lesson and used by many parties as a reference for both business and non-business. 
Research question: 

1. "What is the role of Internal Audit at "Carrefour Indonesia" in risk management and early 
warning? 

2. "Risks; "In particular, what strategic risks are faced by Carrefour Indonesia, and how are these 
risks mitigated?" 

3. "Can the Risk Management Program at Carrefour Indonesia provide an early warning?" 

Theoretical Review, Internal Audit. The Institute of Internal Auditors (THEIIA) explains that 
an internal audit is an independent and objective assurance and consulting activity designed to add 
value and improve organizational operations; it helps organizations achieve their goals by 
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implementing a systematic and disciplined approach to evaluating and improving the effectiveness 
of risk management, control, and governance processes. 

Risk Management. In many discussions about risk, the explanation regarding the definition 
of risk as a combination of possibility and impact is the statement most often used to describe and 
explain the meaning of risk more comprehensively. Other commonly used opinions regarding the 
definition of risk can be found in: 


e Hank Prunckun's Handbook of Scientific Methods of Inquiry for Intelligence Analysis in this 
book describes in general: 

Risk = Likelihood + Consequence; that risk is a combination of possibility (probability) and 
impact (outcome) (Hank, 2010). 

According to Hank Prunckun, 2010 who wrote based on AS/NZS 4360:2004, Risk Management 
is a culture, processes, and structures that lead to knowledge of potential opportunities and 
managing the impact of problems. 

e The Risk Management Standard was issued by a joint team of several risk management 

organizations in the UK. The Institute of Risk Management (IRM), The Association of Insurance 
and Risk Managers (AIRMIC) and The National Forum for Risk Management in the Public Sector 
(ALARM) explain that: 
Risk can be defined as the combination of the probability of an event and its consequences 
(ISO/TEC Guide 73). In all types of the undertaking, there is the potential for events and 
consequences that constitute opportunities for benefit (upside) or threats to success (downside) 
(AIRMIC, 2002). 

e According to The Committee of Sponsoring Organizations of the Treadway Commission (COSO) 
Enterprise Risk Management - Integrated Framework (2004), Activities/Events can have 
negative and positive impacts, or both. Activities/events with negative impacts represent risks 
hindering value creation or destroying existing value (COSO, 2004). 

e AS/NZS ISO 31000:2009 Risk Management - Principles and Guidelines explains that risk is the 
effect of uncertainty on objectives (AS/NZS, 2009). 

Risk Management itself has several different definitions in disclosure but has the same 
meaning as expressed by the following experts: 

e According to Clough and Sears, 1994, Risk Management is a comprehensive approach to 
handling all events that cause losses. 

e According to William et al., 1995, p.27 Risk Management is also an application of general 
management that tries to identify, measure, and handle the causes and effects of uncertainty in 
an organization. 

COSO ERM (2004). Enterprise Risk Management (ERM) discusses the risks and opportunities 
that influence the creation or retention of value. Defined: ERM is a process influenced by an entity's 
board of directors, management, and other personnel, applied in strategy creation and across 
companies, designed to identify potential events/activities that may affect the entity and manage 
risks within limits, to provide adequate assurance regarding the achievement of the entity's 
objectives. This definition reflects several basic concepts: 

e A process is running and moving through an entity; 

e Influenced by people at every level of the organization; 

e Applied in strategy making; 

e Applied across organizations at every level and unit, including describing the risk level of an 
entity; 
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e Designed to identify potential events/ activities that, if they occur, will affect the entity and to 
manage risks within their limits; 

e Able to provide adequate guarantees to the management and board of directors of the entity; 

e Intended for the achievement of objectives in one or separate categories. 


The above definition is deliberately expanded to cover how companies and other 
organizations manage risk, providing a foundation for application across organizations, industries, 
and sectors. Focused directly on achieving the goals set by a particular entity and provides a basis 
for defining ERM effectiveness, includes 8 (eight) interconnected components; comes from the way 
management runs the organization and is integrated with the management process, namely: Internal 
Environment, Objective Setting, Event Identification, Risk Assessment, Risk Response, Control 
Activities, Information and Communication, Monitoring. 

AS/NZS ISO 31000:2009. Risk Management is defined as coordinated activities to direct and 
control an organization against risks. Divided into 3 (three) stages: 

1) Principles (Principles). 

2) Framework: a set of components that provide the foundation and organizational settings for 
designing, implementing, monitoring, reviewing, and continuously improving risk 
management within the organization. 

3) Process: Systematic application of management policies, procedures, and practices to 
communication, consultation, context setting, identification, analysis, evaluation, dealing with, 
monitoring, and reviewing risks. 
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Relationships between the risk management principles, framework and process based on ISO 31000:2009 


Source: AS/NZS ISO 31000:2009 Risk Management - Principles and Guidelines p.vii http:/ /sherq.org/31000.pdf 
Figure 1. Relationships in Risk Management 


Early Warning System. 


e Early warning was mentioned by Paul J.H. Schoemaker and George S. Day as the initial part 
(Tap Local Intelligence) of searching for weak signals. They explained that the key to security 
and reliability is finding problems early (Schoemaker et al., 1991). 

e Edison (2000) defines an early warning system as a system with an accurate definition of 
something and a precise prediction mechanism for a problem. More specifically, the early 
warning system is used for things that are difficult to predict but significantly impact institutions 
(Edison, 2000). 
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e At the Early Warning Conference (EWC) III titled Building an Early Warning System in March 
2006, held in Bonn, Germany, it was clearly stated that knowledge of risk was critical in 
developing an Early Warning System (EWC, 2006). 

e Deloitte (2004) Risk Early Warning System; "This system gives a clear coordinated picture of 
linkage between risks and performance - driving risk management through specifically derived 
performance indicators, focused on the causes of key business risks. Risks are then monitored 
using traffic light reporting of these operational 'lead' indicators - focused on measuring the 
causes and drivers of key risks - rather than 'lag' indicators describing the symptoms or impact 
of these risks. It provides a framework for early warning of future problems so that timely 
management actions can be taken" (Deloitte, 2004). 

e Center for Risk Management Studies (CRMS) Indonesia, "Key risk indicators are certain events 
or things that indicate the occurrence of a risk event. Using key risk indicators in risk monitoring 
activities can provide earlier warning or information to entity management that the possibility 
of a risk event occurring is increasing. It can be realized because monitoring is carried out to 
focus on events that are indications of the occurrence of a risk event, not on the risk event itself. 
Based on this warning or information, the entity can take various mitigation actions early to 
reduce the possibility of a risk event or the impact that the risk may have (if it occurs). So, in 
practice, key risk indicators will act as an early warning system for the entity” (The Role of Key 
Risk Indicators in Risk Management, 2011). 


METHODS 

Approaches and Types of Research. This research uses a qualitative approach and a 
quantitative approach. The data collected comes from interview scripts, interview recordings, 
research notes, photos, personal documents, official documents, questionnaires, surveys, and others 
obtained from open and closed sources. 

Research sites. The research location where this research will be carried out is "Carrefour 
Indonesia," which has its head office at Jalan Lebak Bulus 8, South Jakarta - DKI Jakarta, Indonesia 
12310 as the primary research location. 

Research was also carried out at a traditional market in the Semplak area, Bogor - West Java, 
Indonesia 16310 as an additional research location through survey activities; population between 
700-1000 consumers and customers who shop in 1 (one) day. 

Form of Research. This research was conducted as a case study and is suitable for answering 
how, why, and what. It is a form of in-depth research about a context and aspects of the social 
environment, including humans (Nasution, 2006). 

Case study research can also be called empirical research, which investigates phenomena in a 
real-life context if the boundaries between the phenomenon and the context are not visible (Yin: 
2003). 

Data source. Primary Data: According to Lofland, the main data sources in qualitative research 
are words and actions. According to S. Nasution, primary data is obtained directly from the field or 
research site. Words and actions result from direct observation and interview activities with various 
internal and external parties "Carrefour Indonesia" both openly and privately (Nasution, 1964). 

Secondary Data: data obtained from reading sources and various other sources, which include 
electronic letters, notes, and official documents from government agencies, and can also be in the 
form of bulletins, publications, photographs, and survey results. This secondary data is used to 
strengthen and complement information that has been collected both openly and privately. 

Data Collection Technique. The sampling technique used in the qualitative approach in this 
research is purposive sampling, in the sense that informants as sources of data and information 
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provide information that is and can represent information as a whole, even if only from a limited 
number of sources. 

Meanwhile, the sampling technique used in the quantitative approach in this research is 
simple random sampling; in the sense that each individual selected is determined randomly with 
the same probability during the sampling process, the individual is selected based on the existing 
population with the consideration that the selected individual can represent the entire existing 
population. 

Qualitative data collection methods: 


1) Interview: conducted using an interview guide related to the research problem with various 
parties, including internal "Carrefour Indonesia," sources from the Internal Audit Department 
who are directly involved in the Risk Management process and sources from the Marketing 
Department who are involved in planning and implementing the Strategy, as well as External 
"Carrefour Indonesia" resource person from DISPERINDAG Bogor Regency who was involved 
in discussing and drafting Regional Regulations regarding modern retail and traditional retail 
in the Bogor area, West Java, equipped with interview guidelines and validation documents in 
the form of signature, name, title/ position, office address and contact numbers are attached to 
research documents while still considering elements of confidentiality. 

2) Observation: carried out using all senses, especially the eyes and ears, regarding events that are 
taking place and can be analyzed at the time of the incident, accompanied by visual documents 
that will become part of the analysis. 

3) Documentation: carried out through archives and documentation related to research problems, 
both printed and electronic. 

Quantitative data collection methods: 

1) Survey: carried out using an instrument of questions related to the research problem to become 
supporting analysis material, equipped with research instruments and validation documents in 
the form of signature, name, occupation, age, gender and a summary of the survey results 
attached. The steps that will be taken in this research can also be seen from the following 
framework: 

e Problem formulation; 

e Conduct literature studies as a basis for knowledge; 

e Internal Audit Exposure; 

e Risk exposure with a focus on strategic risk; 

e Presentation of the Risk Management Program with an Early Warning System; 

e Analysis of the implementation of the Risk Management Program and development of the 
Early Warning System; 

e Conclusions and recommendations. 
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Source: Self Processed 


RESULT AND DISCUSSION 
Qualitative. The summary of qualitative research from the results of internal interviews is as 
follows: 

1) “Carrefour Indonesia” will enter the minimarket market; 

2) “Carrefour Indonesia” will carry out re-branding; 

3) Integration into "Carrefour Indonesia" after acquiring Alfa Retailindo, Tbk. After being acquired 
by CT Corporation, there are still many problems related to employees, consumers, systems and 
others; 

4) Carrefour Indonesia's risk management began with the Risk Management program (2010) after 
acquiring Alfa Retailindo, Tbk. While "Carrefour Indonesia" is facing various issues resulting 
from the impact of the acquisition, one of which is the issue of monopoly in the form of lawsuits 
by the KPPU; 

5) "Carrefour Indonesia" has not carried out a reassessment regarding risks at the time of 
acquisition or after being acquired by CT Corporation (2012); 

6) Insufficient and missing risk management human resources have caused the "Carrefour 
Indonesia" Risk Management program to stagnate; 

7) Internal Audit HR has limited numbers, while its role is very crucial in managing risk effectively; 

8) Risk information is sometimes asymmetrical between top management and lower department 
levels due to the need for departmental performance reports to remain sound and the ambiguity 
of the risk department's communication channels within the company organization. 

The summary of qualitative research from the results of external interviews is as follows: 


1) Carrefour Indonesia” has the opportunity to enter the modern mini market format market and 
become a bulldozer that can crush many parties; the monopoly issue will re-emerge as a threat 
that must be considered. 

2) Regulations are a product of political interests, which can change over time. 

The summary of qualitative research from the results of observations is as follows: 

1) There are 2 (two) "Carrefour Express" minimarket outlets joining the "Carrefour Indonesia" 
hypermarket outlets located in Lebak Bulus and MT Haryono. 
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2) The growth of the modern mini market format market is very rapid (Alfamart, Indomaret, 
Lawson, 7 Eleven and others) 

A summary of qualitative research from the results of implementing Risk Management is as follows: 

1) Internal Audit, as the spearhead of risk management, faces enormous challenges. 

2) Risk management with the "Carrefour Indonesia" Risk Management program is reactive (2010), 
implemented when facing the impact of acquiring Alfa Retailindo Tbk. 

3) Indicators of change are not responded to responsively by agents (watches) tasked with 
identifying risks. 

4) After being acquired by CT Corporation, "Carrefour Indonesia" risk management has not been 
reassessed for existing and future risks; the "Carrefour Indonesia" Risk Management program 
can return to being reactive, just running on the impact of those changes. 

5) Information, communication, and monitoring in the risk management process could run better. 

6) The worst-case scenario becomes the single scenario in the "Carrefour Indonesia" Risk 
Management program. 

Quantitative. Summary of quantitative research from a survey of 64 respondents selected 
randomly froma population of 700-1000 visitors /day at the Semplak traditional market, West Bogor. 
Also, around the location within a 1 KM radius, there are several modern markets in the form of 
minimarkets and within a 5 KM radius, several modern markets in the form of 
supermarkets/hypermarkets, with results that can be seen in the table and explanation as follows: 


Table 1. Survey Results 
Traditional Modern Just the 


No. Information 
market market same 
1) Choice of places to shop for general needs 48 16 0 
2) Choice of shopping place based on price 50 11 3 
3) Choice of shopping place based on 
Quality 6 43 15 
Service 1 23 40 


Source: Self Processed 


1) Traditional markets are still the choice for shopping for general needs, according to (48/64) 75% 
of respondents, and are a real threat to the modern market in competing for retail market share 
in Indonesia. 

2) Traditional markets are still chosen because prices are cheaper than modern markets, according 
to (50/64) 78% of respondents. 

3) The modern market was chosen because of its superior quality and service. These 2 (two) things 
are threatening factors in competing with fellow modern markets. 

- Quality: According to (43/64) 67% of respondents prefer products on the modern market for 
quality. 

- Service: According to (40/64), 62.5% of respondents chose the same service in modern and 
traditional markets. 

“Carrefour Indonesia” external environmental audit: 


e Political: Political changes can impact regulatory changes; counter-regulation of modern retail 
business will threaten. 

e Economy: Indonesia's economic predictions are perfect for the next 2-3 decades, triggering an 
increasing number of retail players who want to enter the Indonesian market; the threat of old 
and new modern retail business competitors will be even more significant. 
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e Social: Improvements in the standard of living of the Indonesian people in line with the 
improving economy will make consumers demand better service and quality; there will be a 
threat of losing market share by moving consumers to competitors if demands cannot be 
adequately accommodated. 

e Technology: The rapid development of technology will bring technological risks; Owners of 
leading technology will be the winners of the competition. Conversely, staying caught up in 
technology can result in losing competition in the retail business in the future. 

“Carrefour Indonesia” internal environmental audit: 


e Value: "Carrefour Indonesia" has high value, including its human resources and intellectual 
property; the threat of losing human resources and intellectual property will arise because this 
is a magnet for other parties. 

e Rarity: Retail businesses are familiar with many retail players in Indonesia, and the relationship 
between the principal (employer) and agent (employee) must be considered. The threat of losing 
human resources is getting bigger because there are many options for employees to change jobs 
if they feel that the principle-agent relationship at "Carrefour Indonesia" is no longer conducive. 

e Imitability: Hypermarket and supermarket format retail businesses are challenging to imitate 
because they require significant investments. The threat will arise when "Carrefour Indonesia" 
invests heavily in the hypermarket and supermarket formats at a time when shopping choices 
change to modern markets, minimarket formats, or traditional markets, thereby causing 
significant investment losses. 

e Organization: Distribution of "Carrefour Indonesia" outlets at population concentration points, 
with plans to enter the modern market in a minimarket format will expand the organization; 
management's unpreparedness to keep up with growth will actually be a threat, coupled with 
the threat of the integration process from the new owner (CT Corporation) will also bring many 
internal problems; re-branding can also be a threat to "Carrefour Indonesia" because a new name 
may not necessarily bring something better if it is not appropriately considered. 

The focus is on the changes that occurred at "Carrefour Indonesia" at the end of 2012, namely 
the acquisition event by CT Corporation, which was then related to one of the processes in Risk 
Management (identification); then 2 (two) risk triggers are identified, namely: 

1) Re-Branding 

2) Expansion to minimarket format 

Responding to the 2 (two) events above regarding the risks of "Carrefour Indonesia" are: 

1) Reassessing existing risks and some must change the priority scale in handling them. 

2) Assessment of new risks that will emerge in the future. 

The relevance between the theory and application of the Risk Management Program at 
"Carrefour Indonesia" can be seen as follows: 


e Indicators, as mentioned by Deloitte; in the context of "Carrefour Indonesia" Risk Management, 
indicators are all forms of change, for example, financial indicators in the form of a decline in 
sales, operational indicators in the form of changes in organizational structure, disaster 
indicators in the form of a mass exodus of employees and suppliers, strategic indicators in the 
form of changes in brand or business format which was not responded well. 

e As Schoemaker and Day mentioned, in the context of "Carrefour Indonesia" Risk Management, 
local agents are individuals referred to as watches whom Internal Audit coordinates. They have 
an essential role in seeing and feeling changes, and this role needs to be fixed. 
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e Multi-hypothesis testing and development of various scenarios, as mentioned by Schoemaker 
and Day in the context of "Carrefour Indonesia" Risk Management, a hypothesis is an action plan 
that is only based ona single scenario so that its handling is very limited to the existing scenario. 

e There is asymmetric information (agency problem) and conflict of interest in handling risks for 
"Carrefour Indonesia." 


CONCLUSION 
So, from the results of this research, to answer the research questions, several conclusions can 
be drawn as follows: 
1) The role of "Carrefour Indonesia" Internal Audit is vital, especially in identifying and responding 
to external and internal risks. 
2) The risks of "Carrefour Indonesia" and their mitigation are as follows: 

a. Non-Strategic Risks: Liquidity and cash flow, changes in regulations and politics in 
Indonesia, operational culture, composition of the board of directors, exodus of employees 
and suppliers; 

b. Strategic Risk: Competition, Consumer changes, Industry changes, Consumer demand, 
Integration, Technology Research and development, Intellectual property, including 
strategic risks that the previous Risk Management Program has identified; 

c. Mitigation: The mitigation action for the risks faced by "Carrefour Indonesia" is to start by 
building an Early Warning System so that responses and action steps can be determined 
long before the risk occurs, and a multi-scenario approach will help in determining the steps 
best action steps, with these approaches, the impact and possibility of risk occurring can be 
reduced, in line with increasing the effectiveness and efficiency of business activities for 
adequate guarantees in achieving goals. 

3) The Risk Management Program at "Carrefour Indonesia" cannot be said to provide early warning 
because: 

Assessments related to indicators of change have not been carried out; 

Instruments (watches) are unresponsive to changes or do not function properly; 

The worst-case scenario approach cannot provide a comprehensive picture of the future; 

Limited Monitoring and review of the process; 

There are communication problems related to conveying information; 

There is a problem of interest-related risks to performance. 
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